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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the need for Customs and Border Protection to strengthen key 
management controls for the Importer Self- Assessment program. It is based on 
interviews with employees and officials of relevant agencies and institutions, direct 
observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Anne L. Richards 

Assistant Inspector General for Audits 
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Executive Summary 

We reviewed U.S. Customs and Border Protection's management 
and oversight of the Importer Self-Assessment program. The 
objective of our audit was to determine the efficacy of the Importer 
Self-Assessment program, by which U.S. Customs and Border 
Protection permits importers to conduct self-assessments to verify 
their compliance with federal trade requirements in exchange for 
decreased agency oversight and other benefits. 

U.S. Customs and Border Protection has not fully established key 
management controls for the Importer Self- Assessment program. 
U.S. Customs and Border Protection has not clearly defined the 
program's purpose, established performance measures, issued 
operating procedures, verified the effectiveness of applicants' 
internal controls prior to acceptance into the program, or exercised 
effective oversight of participants' compliance with program 
requirements. As a result, the agency does not have adequate 
assurance that participating importers comply with federal trade 
requirements and, therefore, that government revenues are being 
protected. 

We are making four recommendations to U.S. Customs and Border 
Protection to improve the effectiveness of the Importer Self- 
Assessment program. The U.S. Customs and Border Protection 
agreed with all four recommendations and has initiated action to 
implement them. 
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Background 



The primary goal of U.S Customs and Border Protection (CBP) in 
the trade compliance process is to maximize importer compliance 
with U.S. trade laws, while at the same time facilitating the 
importation and entry of admissible merchandise. With the 
enactment in 1993 of the Customs Modernization Act, CBP 1 
fundamentally changed its relationship with the importing 
community to promote greater shared responsibility for 
compliance with trade laws and regulations. Under the Act's 
provisions, importers are responsible for declaring the value, 
classification, and duty for imports, while CBP is responsible for 
informing importers of their rights and responsibilities for trade 
compliance. To implement these new responsibilities, CBP 
developed a strategy built around the concept of "informed 
[importer] compliance." 

The Importer Self- 
Assessment (ISA) program 
was initiated in 2002 as a 
voluntary approach to trade 
compliance. It is based on 
the premise that importers 
with strong internal 
controls achieve the 
highest level of compliance 
with federal trade laws and 
regulations and require less 
enforcement review and 
oversight. Importers 
enrolled in the ISA 
program assume responsibility for self-governance in exchange for 
less government oversight and other benefits. 

The ISA program is administered through CBP's Office of 
International Trade, Partnership Programs Branch. To apply for 
admission into the program, an importer signs a Memorandum of 
Understanding with CBP agreeing to comply with ISA program 
requirements and submits an application package including 
information on its internal controls. The Office of Regulatory 
Audit staff within the Office of International Trade assesses the 
importer's application and conducts an onsite review. After CBP's 



1 The trade functions of the former U.S. Customs Service were formally transferred to the U.S. Customs 
and Border Protection upon the creation of the Department of Homeland Security in March 2003. 
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ISA Program Benefits 


• 


Consultation with CBP 


• 


Coverage of multiple business 




units 


• 


Removal from CBP's 




Comprehensive Audit pool 


• 


Access to key liaison officials 


• 


Access to summaries of 




participant' s trade data 


• 


Expanded prior disclosure 




privileges 


• 


Mitigated penalties and liquidated 




damages 


• 


Greater business certainty 



review, the agency accepts or rejects the importer for the ISA 
program. 

CBP Account Managers have primary responsibility for 
conducting oversight of participating ISA importers, including 
identifying and analyzing potential trade compliance risks. For 
this purpose, ISA participants are assigned either to a National 
Account Manager under the authority of the Office of International 
Trade or to a Port Account Manager under the authority of CBP's 
Office of Field Operations. As of fiscal year (FY) 2009, 148 ISA 
participating importers were assigned to National Account 
Managers and 47 were assigned to Port Account Managers. The 
195 importers in the ISA program represented an estimated $288 
billion (17%) of the total $1.7 trillion in imports processed by CBP 
that year. 

Each ISA importer must provide annual written notification to 
CBP that it is continuing to meet the requirements of the ISA 
program. CBP Trade Liaisons analyze information provided by 
both the responsible Account Manager and the importer to make a 
risk-based determination of whether the importer should be 
allowed to continue participating in the ISA program. 

Results of Audit 

CBP has not fully established key management controls for the ISA program. 
CBP has not clearly defined the program's purpose, established performance 
measures, issued operating procedures to agency personnel, verified the 
effectiveness of applicants' internal controls prior to acceptance into the program, 
or exercised effective oversight of participants' compliance with program 
requirements. As a result, CBP does not have adequate tools to gain assurance 
that participating importers comply with federal trade requirements and, therefore, 
that government revenues are being protected. 

Management Controls 

CBP has not clearly defined the purpose of the ISA program, developed 
appropriate program performance metrics, or issued the official procedural 
guidance necessary to implement the program. Office of Management and 
Budget Circular A- 123, Management's Responsibility for Internal 
Control, establishes that internal control is a major part of managing an 
organization and "in the broadest sense, includes the plan of organization, 
methods and procedures adopted by management to meet its goals. 



Customs and Border Protection's Importer Self-Assessment Program 

Page 3 



Internal control includes processes for planning, organizing, directing, 
controlling, and reporting on agency operations." 2 

The purpose of the ISA program contained in agency documents differs 
from the purpose that CBP officials communicated to us. The ISA 
Handbook states that the program's purpose is to maintain a high level of 
trade compliance, while agency personnel asserted that the program's 
primary purpose is to allow the agency to focus its limited resources on 
high-risk and unknown importers. Although these purposes are not 
mutually exclusive, each would use different metrics to measure program 
success. Nonetheless, CBP has not established or used metrics to measure 
program performance for either purpose. 

CBP does not assess the ISA program's impact on importer trade 
compliance. To measure program effectiveness, CBP currently compares 
the collective trade compliance rate of ISA importers with that of the 
larger universe of all domestic importers. In FY 2009, CBP reported that 
ISA importers had a collective 99.5% rate of compliance with federal 
trade laws and regulations, while all U.S. importers had a compliance rate 
of 98.5%. This metric does not indicate whether the reported higher level 
of trade compliance among ISA participants was the direct result of their 
participation in the program. CBP does not prepare an assessment on the 
impact of the ISA program on providing oversight to other, higher risk 
importers. 

The ISA program also does not have adequate procedures to guide agency 
staff in performing their program-related responsibilities. Since the 
program's launch in 2002, CBP personnel have relied on either draft or 
insufficiently detailed guidance to implement the program. For example, 
the ISA Handbook provides only limited information to CBP personnel on 
the procedures for assessing importers' ISA applications and conducting 
ongoing compliance monitoring. We previously reported that CBP was 
not properly reviewing ISA importers' annual notifications of their 
continued compliance with program requirements and recommended that 
CBP update the ISA Handbook or issue other internal guidance to 
formalize this process. 3 CBP concurred with our recommendation but had 
not completed implementation as of June 15, 2010. 



2 Office of Management and Budget Circular A- 123, Management's Responsibility for Internal Control, 
states that the term "internal control" is intended to be synonymous with "management controls." 

3 DHS OIG, Management Letter for the FY 2008 DHS Financial Statement Audit, DHS OIG-09-46, March 
2009. 
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ISA Applicants 9 Internal Controls 



CBP's oversight does not ensure that all ISA participants have internal 
controls that demonstrate their ability to comply with federal trade laws 
and regulations. The ISA Handbook requires that CBP conduct reviews of 
the applicant's internal controls prior to accepting an importer into the 
program. In a May 2009 policy statement, CBP's Office of International 
Trade stated that these reviews do not include substantive testing of 
applicants' controls, and therefore do not provide reasonable assurance as 
to the effectiveness of importers' internal controls. 4 As a result, importers 
were accepted into the ISA program without adequate assurance that their 
internal controls would result in compliance with federal trade laws and 
regulations. 

CBP also circumvented its official process for accepting importers into the 
ISA program. Since December 2005, CBP recruited 13 importers into the 
ISA program based on their successful completion of Focused 
Assessments. During a Focused Assessment, CBP evaluates an importer's 
internal control systems to ensure that the filing of transactions and 
declarations is in compliance with trade laws and regulations. In contrast 
to the review processes established in the ISA Handbook, Focused 
Assessments are based on historical information about an importer's 
compliance history rather than on the current state of its system of internal 
controls. As such, the internal controls of recruited importers were not 
assessed according to the same process as those of importers reviewed 
before being accepted into the ISA program. CBP officials told us that 
this recruitment process was suspended in 2008 until the agency develops 
specific policy and procedures for the process. However, this action did 
not resolve the issue of ensuring that the recruited importers are qualified 
for the program. 

To ensure that the recruited importers are adhering to ISA program 
requirements, CBP is conducting continuation reviews on the importers. 
Although no procedures exist for conducting such reviews, CBP officials 
told us that the process is similar to the internal control assessments 
conducted on importers prior to their acceptance in the ISA program. As 
of April 2010, CBP had completed continuation reviews on 6 of the 13 
recruited ISA importers. Of these, one importer was found to have 
inadequate internal controls to support ongoing trade compliance self- 
assessment and voluntarily withdrew from the program. Although CBP 
plans to conduct continuation reviews on two more of these importers, no 
such follow-up reviews are currently scheduled for the remaining five. 



4 CBP Policy Memorandum 09-04, May 18, 2009. 
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ISA Importer Oversight 



The ISA program's organizational structure does not support consistent or 
effective oversight of ISA importers. CBP National Account Managers 
and Port Account Managers have primary responsibility for overseeing 
ISA program importers, including identifying and analyzing potential 
trade compliance risks. National Account Managers operate in the Office 
of International Trade, which administers the ISA program. Port Account 
Managers are assigned to Office of Field Operations staff. As a result, the 
Office of International Trade is limited in its ability to require Port 
Account Managers to conduct ISA program specific oversight activities. 

For example, CBP's Office of International Trade issued a draft 
guidebook to National Account Managers identifying the protocols for 
conducting ISA importer oversight. Port Account Managers follow no 
written procedures in performing their ISA-specific oversight 
responsibilities. Based on our analysis of National Account Manager and 
Port Account Manager reviews of ISA importers' annual notification 
letters, we determined that National Account Managers exercised 
sufficient oversight over their ISA accounts in FY 2009, while Port 
Account Managers did not. 

We are also concerned that the National Account Managers and Port 
Account Managers do not adequately review the results of ISA importers' 
annual self-assessments. The ISA Handbook requires that ISA importers 
assess their compliance with CBP laws and regulations by annually 
conducting risk-based self-testing. Importers are required to implement 
changes to their internal controls based on the result of their self- 
assessments. According to CBP, Account Managers do not routinely 
request importers' annual self-assessment results because of the volume of 
information and a lack of the skills necessary to analyze them effectively. 
Reviewing annual self-testing results would allow CBP to monitor ISA 
importers' compliance with program requirements more completely. 
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Recommendations 

We recommend that the Assistant Commissioner for the Office of 
International Trade: 

Recommendation #1 : Establish policy and procedures that document the 
management controls needed for ISA program operations, including: 

• The purpose, goals, and objectives of the ISA program; 

• The performance metrics to measure the effectiveness of the program 
in meeting the established purpose, goals, and objectives; and 

• The formal procedural guidance necessary to support consistent and 
effective implementation of the program. 

Recommendation #2 : Assess the risks to trade compliance associated 
with the current policies and procedures for accepting importers into the 
ISA program, and establish internal controls to ensure that risks identified 
are mitigated to provide reasonable assurance of ISA participants' 
compliance with trade laws and regulations. 

Recommendation #3 : Require Port Account Managers to follow the 
same policy and procedures for oversight of ISA importers as National 
Account Managers, or remove ISA program oversight responsibilities 
from Port Account Managers. 

Recommendation #4 : Establish policy and procedures to ensure that ISA 
importers' annual self-testing results are requested and reviewed for 
compliance with program requirements. 

Management Comments and OIG Analysis 
CBP Comments to Recommendation 1: 

Concur . CBP plans to establish and strengthen internal controls to clearly 
define the ISA program's purpose and achieve more consistent and 
effective program implementation. Currently under development, these 
controls will ultimately be reflected in formal agency policy and 
procedures addressing program goals and objectives, appropriate measures 
of program performance, and uniform operational guidance to personnel. 

OIG Analysis: 

As described in its response, CBP's current and planned actions satisfy the 
intent of this recommendation, which we consider resolved. However, 
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this recommendation will remain open until we verify through a review of 
appropriate supporting documentation provided by CBP that the stated 
corrective actions have been fully implemented. 

CBP Comments to Recommendation 2: 

Concur . CBP plans to develop and implement improved management 
controls over the ISA program designed to mitigate risks to participating 
importers' non-compliance with trade laws and regulations. These 
planned improvements will provide for enhanced procedures governing 
the on-going monitoring and oversight of ISA importers by responsible 
CBP personnel. CBP's plans also describe actions it believes will help it 
to more proactively assess and act upon identified risks to participating 
importers' trade compliance as they emerge. 

OIG Analysis: 

Because CBP's response does not address risks to trade compliance posed 
by its current policy and procedures for accepting importers into the ISA 
program, we consider this recommendation to be unresolved. In our 
report, we indicate the internal controls of all ISA importers were not 
assessed consistently prior to program acceptance, which raised questions 
about certain participants' qualifications for admission. We further report 
that CBP policy does not provide for substantive testing of applicants' 
internal controls, which precludes CBP from providing adequate assurance 
as to the effectiveness of an importer's internal controls in support of on- 
going trade compliance self-assessment once enrolled. 

This recommendation will remain unresolved until we receive a 
supplemental response from CBP that sufficiently addresses its plans for 
assessing the trade compliance risks associated with its current importer 
acceptance policy and procedures, and for reasonably assuring that all 
applicants' internal controls are verified as sufficiently effective to support 
on-going trade compliance self-assessment. Further, this recommendation 
will remain open until we verify through a review of appropriate 
supporting agency documentation that these and the remaining planned 
actions concerning improved ISA importer compliance monitoring and 
oversight have been fully implemented. 

CBP Comments to Recommendation 3: 

Concur . By the end of the current fiscal year, CBP plans to assign 
exclusive responsibility for conducting all ISA importer oversight and 
monitoring activities to National Account Managers. 
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QIG Analysis: 



Because CBP's stated actions satisfy the intent of the recommendation, we 
consider it resolved. However, the recommendation will remain open 
until we can verify through a review of supporting agency documentation 
that National Account Managers have been assigned to conduct 
monitoring and oversight of each importer actively enrolled in the ISA 
program by the end of the current fiscal year. 

CBP Comments to Recommendation 4: 

Concur . CBP plans to enhance several procedures related to ISA 
importers' required annual testing of internal controls and notification to 
CBP of their continued readiness to assume the responsibilities of trade 
compliance self-assessment. These planned enhancements specifically 
concern how participating importers are to conduct self-testing, what 
information they are to annually provide to CBP, and actions CBP may 
take to review the testing results. 

QIG Analysis: 

Although CBP's plans to take several near-term actions related to 
importers' annual self-testing and notification procedures, it provided 
insufficient details for us to resolve the recommendation. As such, the 
recommendation will remain unresolved until CBP provides us with 
additional information specifically describing what elements of ISA 
importers' annual self-testing results are to be reported to CBP, how CBP 
will annually request and review this information, and how CBP plans to 
respond to trade compliance risks identified during the review of 
importers' testing results. Further, this recommendation will remain open 
until we verify through a review of appropriate supporting agency 
documentation that these and the remaining planned actions designed to 
enhance CBP's review of ISA importers' annual self-testing results have 
been fully implemented. 
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Appendix A 

Purpose, Scope, and Methodology 

The objective of our audit was to determine the efficacy of the 
Importer Self-Assessment (ISA) program. We obtained and 
reviewed Customs and Border Protection (CBP) policies and 
procedures pertaining to the ISA program for the period ending 
September 30, 2009. We also interviewed CBP personnel 
responsible for the management, oversight, and execution of the 
ISA program. 

We reviewed CBP draft and official program documentation; trade 
compliance data; federal laws, regulations, and notices; planning 
documents; and status and monitoring reports related to the ISA 
program. We reviewed prior Government Accountability Office, 
DHS OIG, and other external third-party reports relating to the ISA 
program. In addition, we selected and reviewed a judgmental 
sample of ISA importer files. 

We conducted interviews with officials from CBP's Office of 
International Trade, including Trade Facilitation and 
Administration, Partnership Programs Branch, and Regulatory 
Audit. 

We evaluated CBP's internal controls to the extent necessary to 
accomplish our objective. Specifically, we developed an 
understanding of internal controls over the ISA program by 
reviewing the ISA Handbook and other agency guidance and 
interviewing CBP officials assigned to oversee the ISA program. 
The understanding we gained was used to plan the audit and 
determine the nature, timing, and extent of the tests we performed. 

We conducted this performance audit between January and June 
2010 under the authority of the Inspector General Act of 1978, as 
amended, and according to generally accepted government 
auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based 
on our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for our findings and conclusions based 
on our audit objectives. 
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Appendix B 

Management Comments to the Draft Report 



U.S. Department of Homeland Security 

Washington. DC 20229 




U.S. Customs and 
Border Protection 



August 4, 2010 



MEMORANDUM FOR RICHARD L. SKINNER 
INSPECTOR GENERAL 
DEPARTMENT OF HOMELAND SECURITY 



FROM: Assistant Commissi onei 

Office of Internal Affaii 



U.S. Customs and Border Protection 




SUBJECT: 



Response to the Office of Inspector General's Draft Report 
Entitled, "Customs and Border Protection's Importer Self- 
Assessment Program" 



Thank you for providing us with a copy of your draft report entitled "Customs and 
Border Protection's Importer Self-Assessment Program," and the opportunity to comment 
on the issues in this report. 

The report contains four recommendations for CBP action. A summary of CBP actions 
and corrective plans to address the four recommendations is provided below: 

Recommendation #1: Establish policy and procedures that document the 
management controls needed for ISA program operations, including: 

■ The purpose, goals, and objectives of the ISA program; 

■ The performance metrics to measure the effectiveness of the program in 
meeting the established purpose, goals, and objectives; and 

■ The formal procedural guidance necessary to support consistent and 
effective implementation of the program. 

CBP Response: CBP concurs with the recommendation, CBP is currently working on 
enhancing the Importer Self-Assessment (ISA) Program's Standard Operating Procedures 
(SOP) to clearly stipulate the program purpose, goals and objectives. As part of our 
ongoing efforts to strengthen the monitoring and oversight of ISA, we are identifying 
performance measures to validate the benefits of the ISA Program and how to improve 
the program. The performance measures will focus on whether the program has achieved 
its objectives, as expressed by measurable standards. CBP will develop formal 
procedures and issue guidance to the port personnel, national account managers, and 
other stakeholders as necessary to ensure uniformity, consistency and monitoring of the 
ISA Program. 

Due Date; October 31. 2010 
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Appendix B 

Management Comments to the Draft Report 



Recommendation 2: Assess the risks to trade compliance associated with the 
current policies and procedures for accepting importers into the ISA program, and 
establish internal controls to ensure that risks identified are mitigated to provide 
reasonable assurance of ISA participants' compliance with trade laws and 
regulation. 

CBP Response: CBP concurs with the recommendation. The ISA program will be 
managed to mitigate risks to CBP by the following processes: 

1 . An enhanced Annual Notification Letter ( ANL) will be developed that will 
substantively broaden the reporting information from member companies. The 
information will provide additional criteria to better evaluate a company's risk 
from the prior year. In addition, the information will enable CBP to determine if 
the action the company implemented to mitigate those risks meets the new 
standards of the ISA program. 

2. Enhanced processes and procedures will be developed and implemented to 
provide a higher level of evaluation of the ANL. This will allow CBP to identify 
the emergence of risk factors from the prior year, and will aid in the selection of 
candidates for closer national account manager reviews or revisits by Regulatory- 
Audit. 

3. The role of the national account manager relative to ISA oversight will be 
formally defined and strengthened to increase the depth and scope of the 
membership monitoring. 

4. The ISA Continuation Review Meeting (1-3) will be expanded with the 
development of criteria that will identify member companies subject to 1-3 
reviews utilizing both criteria for cause and other measures such as length of 
membership without any or recent review. 

5. Guidelines will be established for uniformity to monitor ISA member companies 
by CBP which will reinforce the oversight process. 

Overall, new and reinforced processes and formal procedures will be implemented to 
identify potential issues and adopt additional follow-up actions on member companies to 
mitigate risks on a continuing basis. 

It should be noted that CBP has implemented several control and monitoring activities 
that will strengthen the monitoring and oversight of the program. Specifically. CBP: 

■ Modified the internal review checklist to verify that the key components of the 
national account manager's risk assessment and the variances, changes, and 
modifications reported by the company on its annual notification have been 
considered and adequately addressed; 

■ Established a uniform process which entail key factors to be included in the 
national account manager's annual risk assessment: and, 

m Developed a process to issue timely notifications to ISA members and created 
standardized correspondence templates to acknowledge ISA applications received 
notification of incomplete applications, results of ANL review, etc. 

Due Date: February 28, 201 1 
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Appendix B 

Management Comments to the Draft Report 



3 

Recommendation 3: Require Port Account Managers to follow the same policy and 
procedures for oversight of ISA importers as National Account Managers, or 
remove ISA program oversight responsibilities from Port Account Managers, 

CBP Response: CBP concurs with the recommendation. CBP is phasing out the port 
account manager's role in monitoring and providing annual risk assessments in regards to 
ISA participants. All ISA accounts will be assigned to a national account manager by the 
end of the fiscal year. 

Due Date: September 30, 2010 

Recommendation 4: Establish policy and procedures to ensure that ISA importers 
annual self-testing results are requested and reviewed for compliance with program 
requirements. 

CBP Response: CBP concurs with the recommendation. CBP is in the process of 
enhancing and strengthening the ISA Annual Notification and reporting of self-testing 
results. Some of the enhancements include: 

■ Clarifying the required elements to be included in the annual notification letter. 

■ Initiate periodic Continuation Review Meetings (CRM) of ISA participants. 

■ Review of ISA participants self testing results during the CRM. 

Develop and provide improved guidance on developing the self-testing plan. CBP will 
publish the final policy document. 

Due Date: October 31,2010 

With regard to the classification of the draft report. CBP did not identify any information 
that would warrant a "For Official Use Only" classification. 

If y ou have any questions regarding this response, please contact me or have a member of 
your staff contact Ms. Ashley Bush. CBP Audit Liaison, at (202) 344-2539. 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



